Full Report
Erlang security advisory (AV26-948)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Erlang/OTP
## CVE Details
- **CVE ID:** CVE-2026-65634, CVE-2026-89422
- **CVSS Score:** Not explicitly provided in source (Typically High for OTP core flaws)
- **CWE:** Not specified in source
## Affected Systems
- **Products:** Erlang/OTP
- **Versions:**
- OTP 17.0 Prior to 27.3.4.18
- 21b8a1b Prior to afec515, 98c66c8, and fd1d9d0
- 22.2 Prior to 27.3.4.18, 28.5.0.7, and 29.1.1
- 4.1.1 Prior to 5.2.11.13, 5.5.2.6, and 6.0.6
- 9.5 Prior to 11.2.12.13, 11.6.0.6, and 11.7.7
- Versions Prior to commit 84adefa
- **Configurations:** Systems utilizing Erlang/OTP for distributed computing or telecommunication infrastructure.
## Vulnerability Description
While the specific technical mechanics (e.g., buffer overflow, logic error) are not detailed in the summary advisory, these CVEs address security flaws within the Erlang Open Telecom Platform (OTP) framework. Historically, vulnerabilities in this product often relate to the distribution protocol, SSL/TLS implementation, or improper handling of external terms.
## Exploitation
- **Status:** Not specified (Assume PoC may be in development given the advisory date)
- **Complexity:** Not specified
- **Attack Vector:** Network (Likely, given the nature of OTP)
## Impact
- **Confidentiality:** Potential for unauthorized data access.
- **Integrity:** Potential for unauthorized modification of data or processes.
- **Availability:** Potential for Denial of Service (DoS) or system instability.
## Remediation
### Patches
Users are encouraged to update to the following versions or later:
- **OTP 27.x:** 27.3.4.18
- **OTP 28.x:** 28.5.0.7
- **OTP 29.x:** 29.1.1
- **Sub-component versions:** 5.2.11.13, 5.5.2.6, 6.0.6, 11.2.12.13, 11.6.0.6, and 11.7.7.
### Workarounds
- No specific workarounds provided. Patching is the recommended course of action.
- General hardening: Restrict access to Erlang distribution ports (default 4369 for EPMD) to trusted internal networks only.
## Detection
- **Indicators of Compromise:** Unusual crashes in the BEAM virtual machine or unexpected node connections.
- **Detection methods and tools:** Audit Erlang node logs and monitor network traffic for atypical inter-node communication.
## References
- **Vendor Advisories:** hxxps[://]cna[.]erlef[.]org/cves/CVE-2026-65634[.]html
- **Vendor Advisories:** hxxps[://]cna[.]erlef[.]org/cves/CVE-2026-89422[.]html
- **GitHub Security:** hxxps[://]github[.]com/erlang/otp/security/advisories/
- **Original Source:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/erlang-security-advisory-av26-948